DETAILED ACTION
Summary
This Office Action is in response to reply dated July 29, 2026. Claims 1-11 are currently pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 3, 4, 5, 9, 10 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Yamamoto (WO 2019/239658 A1) in view of Tasaki (WO/2022/107378, note all citations hereafter will refer to US Patent 12,432,226 B2, a continuation of PCT/JP2021/025100, which serves as a translation for WO/2022/10737 published in Japanese on May 27, 2022).
Regarding claim 1, Yamamoto discloses a notification device (see at least Figure 1, item 50 | page 3, lines 37-38, note Figure 1 is a diagram illustrating a network configuration in a vehicle 50 to which a cyber attack notification device of the present embodiment is applied) comprising:
a processor (see at least Figures 1-2, items 100, 110 and 130 | page 4, lines 8-26, note the gateway ECU 100 includes a CPU 110 that executes a cyber attack detection program stored in the ROM 130 of the system); and
a memory including a program that, when executed by the processor (see at least Figures 1-2, items 100, 110 and 130 | page 4, lines 8-26), causes the processor to:
obtain an intrusion depth of a cyber attack on a moving body (see at least page 7, line 28 – page 8, line 7, note when the cyber attack detection unit 330 detects a cyber attack (YES in S11), the risk analysis unit 340 analyzes the risk for the detected cyber attack (S12) via an ID that indicates attack content from the cyber attack detection unit 330, wherein the risk analysis unit 340 refers to the risk analysis DB 342 to obtain a total score (degree of risk) for the attack indicated by the received ID);
obtain a passenger state of a passenger in the moving body (see at least page 5, lines 11-24 | page 8, lines 23-34);
determine a notification mode based on the intrusion depth obtained and the passenger state obtained (see at least page 8, lines 8-15, note the notification method determination unit 360 determines whether to notify the driver of the vehicle 50 based on comparing the received score with a threshold value, and determines that it is necessary to notify the driver when the received score is larger than the threshold value | page 8, lines 23-24, note next the notification method determination unit 360 determines the state of the driver | page 8, line 35 – page 9, line 9 | page 6, lines 37-40); and
cause a security notification to be output, the security notification being for notifying, in accordance with the notification mode, the passenger that the cyber attack was made (see at least page 7, lines 1-13, note the abnormality notification unit 380 notifies the driver of the cyber attack), and
the processor is further configured to indicate a component, of the plurality of components in the moving body, the cyber attack has reached (see at least page 10, lines 19-27, note the content of the notification includes attack information comprising a text message of the content of the attack, that is, the attack target and attack method, see page 6, lines 5-8).
However, Yamamoto does not specifically disclose wherein the processor is configured to identify the intrusion depth based on a number of a plurality of components in the moving body through which the cyber attack has propagated along an intrusion route within the moving body.
It is known to determine the extent of a cyber attack. For example, Tasaki teaches a cyber attack detection system with a processor configured to identify the intrusion depth of a cyber attack based on a number of a plurality of components in the moving body through which the cyber attack has propagated along an intrusion route within the moving body (see at least Figure 24 of Tasaki in US 12,432,226 B2 | col. 7, lines 10-46 of Tasaki in US 12,432,226 B2, note each of the IFs 21 and ECUs 22 include an Intrusion Detection System IDS 23 that detects an anomaly | col. 18, lines 39-60 of Tasaki in US 12,432,226 B2, note after obtaining the entry point and the attack target, at least one path connecting the entry point with the attack target as an attack path candidate is calculated, wherein once at least one attack path candidate is calculated, the attack path estimator refers to the anomaly detection information, and estimates the attack path candidate, among the at least one attack path candidate, which has the highest number of IDSs 23 that detected an anomaly, as the attack path | col. 20, lines 29-34 of Tasaki in US 12,432,226 B2).
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features of Tasaki into Yamamoto. This helps eliminate unlikely cyber attack paths.
Regarding claim 2, Yamamoto in view of Tasaki teach wherein the processor causes the security notification to be output at timing when the intrusion depth reaches a predetermined depth (see at least page 8, lines 8-15 of Yamamoto, note the notification method determination unit 360 determines whether to notify the driver of the vehicle 50 based on comparing the received score with a threshold value, and determines that it is necessary to notify the driver when the received score is larger than the threshold value).
Regarding claim 3, Yamamoto in view of Tasaki teach wherein the processor selects a notification device according to the passenger state from among a plurality of candidates for the notification device, and causes the notification device selected to output the security notification (see at least page 8, line 35 – page 9, line 9 of Yamamoto, note notifying the driver via a device inside the vehicle, outside the vehicle or both).
Regarding claim 4, Yamamoto in view of Tasaki teach the program, when executed, further causes the processor to obtain a moving body state of the moving body, and the processor determines the notification mode based also on the moving body state obtained (see at least page 8, lines 16-22 of Yamamoto).
Regarding claim 5, Yamamoto in view of Tasaki teach wherein the moving body state includes at least one of whether the moving body is activated, a movement speed of the moving body, or whether the moving body is in an autonomous movement mode (see at least page 8, lines 16-22 of Yamamoto, note vehicle speed).
Regarding claim 9, Yamamoto discloses a notification method to be executed by a computer (see at least Figure 1, item 50 | page 3, lines 37-38, note Figure 1 is a diagram illustrating a network configuration in a vehicle 50 to which a cyber attack notification device of the present embodiment is applied | page 4, lines 14-26), the notification method comprising:
obtaining an intrusion depth of a cyber attack on a moving body (see at least page 7, line 28 – page 8, line 7, note when the cyber attack detection unit 330 detects a cyber attack (YES in S11), the risk analysis unit 340 analyzes the risk for the detected cyber attack (S12) via an ID that indicates attack content from the cyber attack detection unit 330, wherein the risk analysis unit 340 refers to the risk analysis DB 342 to obtain a total score (degree of risk) for the attack indicated by the received ID);
obtaining a passenger state of a passenger in the moving body (see at least page 5, lines 11-24 | page 8, lines 23-34);
determining a notification mode based on the intrusion depth obtained and the passenger state obtained (see at least page 8, lines 8-15, note the notification method determination unit 360 determines whether to notify the driver of the vehicle 50 based on comparing the received score with a threshold value, and determines that it is necessary to notify the driver when the received score is larger than the threshold value | page 8, lines 23-24, note next the notification method determination unit 360 determines the state of the driver | page 8, line 35 – page 9, line 9 | page 6, lines 37-40); and
causing a security notification to be output, the security notification being for notifying, in accordance with the notification mode determined, the passenger that the cyber attack was made (see at least page 7, lines 1-13, note the abnormality notification unit 380 notifies the driver of the cyber attack), wherein
the security notification indicates a component, of the plurality of components in the moving body, the cyber attack has reached (see at least page 10, lines 19-27, note the content of the notification includes attack information comprising a text message of the content of the attack, that is, the attack target and attack method, see page 6, lines 5-8).
However, Yamamoto does not specifically disclose wherein the intrusion depth is identified based on a number of a plurality of components in the moving body through which the cyber attack has propagated along an intrusion route within the moving body.
It is known to determine the extent of a cyber attack. For example, Tasaki teaches a cyber attack detection system wherein the intrusion depth of the cyber attack is identified based on a number of a plurality of components in the moving body through which the cyber attack has propagated along an intrusion route within the moving body (see at least Figure 24 of Tasaki in US 12,432,226 B2 | col. 7, lines 10-46 of Tasaki in US 12,432,226 B2, note each of the IFs 21 and ECUs 22 include an Intrusion Detection System IDS 23 that detects an anomaly | col. 18, lines 39-60 of Tasaki in US 12,432,226 B2, note after obtaining the entry point and the attack target, at least one path connecting the entry point with the attack target as an attack path candidate is calculated, wherein once at least one attack path candidate is calculated, the attack path estimator refers to the anomaly detection information, and estimates the attack path candidate, among the at least one attack path candidate, which has the highest number of IDSs 23 that detected an anomaly, as the attack path | col. 20, lines 29-34 of Tasaki in US 12,432,226 B2).
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features of Tasaki into Yamamoto. This helps eliminate unlikely cyber attack paths.
Regarding claim 10, Yamamoto in view of Tasaki teach a non-transitory computer-readable recording medium for use in a computer, the non-transitory computer readable medium having recorded thereon a computer program for causing the computer to execute the notification method according to claim 9 (see at least page 4, lines 8-26 of Yamamoto).
Regarding claim 11, Yamamoto discloses wherein the processor is configured to determine the notification mode such that, as the cyber attack has a higher score, the cyber attack is treated as having a higher risk (see at least page 12, lines 34-38 of Yamamoto, note the highest risk cyber attacks are notified to the driver | page 8, lines 8-15 of Yamamoto | page 8, line 39 – page 9, line 9 of Yamamoto).
However, Yamamoto does not specifically disclose as a component reached by the cyber attack is located deeper along the intrusion route.
It is known to determine cyber attack risk in different ways. For example, Tasaki teaches a cyber attack detection system that as a component reached by the cyber attack is located deeper along the intrusion route, the cyber attack is treated as having a higher risk (see at least Figure 14, steps S100→S101→S103→S104 (anomaly detected) and S100→S101→S103→S105 (false detection) of Tasaki in US 12,432,226 B2 | col. 14, lines 13-64 of Tasaki in US 12,432,226 B2 | Figure 24 of Tasaki in US 12,432,226 B2, note cyber attacks with the deepest intrusion routes having the highest risk are displayed most severe to less severe, such as those with false detections, as shown by S100→S101→S103→S105 (false detection)).
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features of Tasaki into Yamamoto. This helps eliminate unlikely cyber attack paths for notification.
Claims 6, 7 and 8 are rejected under 35 U.S.C. 103 as being unpatentable over Yamamoto (WO 2019/239658 A1) in view of Tasaki (WO/2022/107378, note all citations hereafter will refer to US Patent 12,432,226 B2, a continuation of PCT/JP2021/025100, which serves as a translation for WO/2022/10737 published in Japanese on May 27, 2022) as applied to claims 1 and 4 above, and in further view of Ishihara (US 2017/0291544 A1).
Regarding claim 6, Yamamoto in view of Tasaki do not specifically teach wherein the moving body state includes a use mode of the passenger who is using the moving body, and the processor determines the notification mode under a rule that is different depending on the use mode.
It is known to adjust notifications for a variety of different reasons. For example, Ishihara teaches a system wherein the moving body state includes a use mode of the passenger who is using the moving body, and a processor determines the notification mode under a rule that is different depending on the use mode (see at least [0099] | [0097-0098] | [0101] | [0043]).
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features of Ishihara into Yamamoto in view of Tasaki. This provides the ability to deliver more intense warnings to a driver/occupant that may be distracted during an autonomous mode, than a driver/occupant that is driving a vehicle under manual operation.
Regarding claim 7, Yamamoto in view of Tasaki and Ishihara teach wherein the moving body state includes a configuration of a notification device provided in the moving body (see at least [0099] of Ishihara, note more severe alerts are provided via notification devices in the autonomous mode as compared to the manual mode | [0097] of Ishihara, note different notification devices can provide different alerts based on their position in the vehicle (in relation to the occupant’s position) and the type of autonomous driving mode the vehicle is in), and the processor determines, for each of notification devices provided in the moving body, a notification order according to the passenger state, and causes each of the notification devices to output the security notification in the notification order determined, each of the notification devices being the notification device (see at least [0097-0098] of Ishihara, note the notification order corresponds to whatever notification devices the occupant is currently focusing, facing or adjacent to, and if positional changes occur, the notification devices are changed accordingly).
Regarding claim 8, Yamamoto in view of Takaki and Ishihara teach wherein one or more passengers are in the moving body, each of the one or more passengers being the passenger, the notification mode includes specifying a target passenger to be notified among the one or more passengers, the target passenger being based on the passenger state, and the processor causes the security notification to be output, with the security notification notifying the target passenger and not notifying remaining passengers excluding the target passenger that the cyber attack was made (see at least [0043] of Ishihara, note any number of occupants can be transported by the vehicle, and any one of them can be monitored and provided information or the alert, that is, only a specific occupant is provided with the alert, not the others).
Response to Arguments
Applicant’s arguments with respect to claims rejected under 35 U.S.C. 102(a)(1) as being anticipated by Yamamoto (WO 2019/239658 A1) have been considered but are moot in view of the new ground of rejection.
Conclusion
Applicant’s amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRIAN WILSON whose telephone number is 571-270-5884. The examiner can normally be reached Monday-Friday 9:00-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, DAVETTA GOINS can be reached at 571-272-2957. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRIAN WILSON/Primary Examiner, Art Unit 2689
Prosecution Insights